5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe
Size 44KB
Sample260930-l3yzwsvyht
SHA256 5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a
MD5 84b9bc426e01b58fe0cb78e699d5793f
SHA1 e61f392a9d442dc7700a1634eacfa09944313aa5
SHA512 6bb8152fbdaecc4e5234c99d5b882eee4fb6ad94d24ed1b0bb3ce7bbdc475d76e677f48abff1e1520ee922eba1c9a12b1df9459fb70d588b0cfc511845a92fc6
SSDEEP 192:oFign3mWS4ds+vxPu4PMhgMQZVzbnM6uKMlnTzENw2zmZSmFhpct5UGzJ0w:o0gn2H4BvrtPZZbM62lnTAMZSehpct5
TLSH
T1D61349872E0458B3D1E94071352B66369BBAA831977B8897DB736FE5AC301E84D32107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
6088	jsedfk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jsedfk.exe	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe
File created	C:\Windows\SysWOW64\jsedf.dll	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsedfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2948	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe
2948	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 6088	2948	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe	89
PID 2948 wrote to memory of 5660	2948	jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\jsedfk.exe
  C:\Windows\system32\jsedfk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a.exe.bat
Size 274B
SHA256 4c30495217908445185478b7edf7ca401eccbbc01631e68814d81dd5f7a5cb6d
MD5 37f8a57780c53f8d69185dfe1ead5b04
SHA1 abfdf83fa9064a37055211a420b165c8a9bdd744
SHA512 3a3ade2910c9b4f6a725f8cfdd2971562d93d2d5633eccade3b367cb1948d296360f4c36ca39cbb958ffcee88e1194030e10098b5be450f690aa01026ba9f9bf
TLSH
T19AD02B50219ACB4E9488EE2FB439EF4E418B2C5E164E3F220B11C1C8038303CB28D704
MD5 SHA1 SHA512 TLSH

Submit Download

jsedfk.exe

Path C:\Windows\SysWOW64\jsedfk.exe
Size 44KB
SHA256 5bbea2c72fee1409671538e62db9800cac22a332ea1162da118d11a427a97f4a
MD5 84b9bc426e01b58fe0cb78e699d5793f
SHA1 e61f392a9d442dc7700a1634eacfa09944313aa5
SHA512 6bb8152fbdaecc4e5234c99d5b882eee4fb6ad94d24ed1b0bb3ce7bbdc475d76e677f48abff1e1520ee922eba1c9a12b1df9459fb70d588b0cfc511845a92fc6
SSDEEP 192:oFign3mWS4ds+vxPu4PMhgMQZVzbnM6uKMlnTzENw2zmZSmFhpct5UGzJ0w:o0gn2H4BvrtPZZbM62lnTAMZSehpct5
TLSH
T1D61349872E0458B3D1E94071352B66369BBAA831977B8897DB736FE5AC301E84D32107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download